CVE-2024-28949: Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which…

PriorityP432medium6.5CVSS 3.1

AVNACLPRLUINSUCNINAH

EPSS

0.56%

43.3th percentile

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 9.3.0+incompatible < 9.3.3+incompatible	9.3.3+incompatible
github.com	mattermost_mattermost-server	>= 9.4.0+incompatible < 9.4.4+incompatible	9.4.4+incompatible
github.com	mattermost_mattermost-server	>= 9.5.0+incompatible < 9.5.2+incompatible	9.5.2+incompatible
github.com	mattermost_mattermost_server_v8	>= 8.1.0 < 8.1.11	8.1.11
github.com	mattermost_mattermost_server_v8	>= 9.3.0 < 9.3.3	9.3.3
github.com	mattermost_mattermost_server_v8	>= 9.4.0 < 9.4.4	9.4.4
github.com	mattermost_mattermost_server_v8	>= 9.5.0 < 9.5.2	9.5.2
mattermost	mattermost	8.1.0 – 8.1.10	—
mattermost	mattermost	9.3.0 – 9.3.2	—
mattermost	mattermost	9.4.0 – 9.4.3	—
mattermost	mattermost	9.5.0 – 9.5.1	—
mattermost	mattermost_server	>= 8.1.0 < 8.1.11	8.1.11
mattermost	mattermost_server	>= 9.3.0 < 9.3.3	9.3.3
mattermost	mattermost_server	>= 9.4.0 < 9.4.4	9.4.4
mattermost	mattermost_server	>= 9.5.0 < 9.5.2	9.5.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.